Home / Skills / code-security

code-security From the maker

Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. IMPORTANT: Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security. Also use when users ask to 'review my code', 'check this for bugs', or 'is this safe'.

Scanned · 1 to knowSkillSource: GitHubFrom the maker (verified org) · no license file

330 stars +3 this week Updated 3mo ago License none (maker) Context ≈153 tokens always loaded

49popular

Why this score

Stars

14/35

Usage (forks)

5/15

Upkeep

15/25

License

5/15

Owner history

10/10

This repo hosts 3 skills, so its 330 stars are split between them (about 110 each) for scoring.

Popularity score: 49/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

Security

Scanned Oct 20, 2026 at commit 68177b8830f9, with Cisco's open-source skill-scanner.

What its code does:

Runs shell commands Common for dev tools. Read the commands it runs.AGENTS.md:307, rules/command-injection.md:25 and 2 more

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Prompts that use GitHub

GitHub Repository Analysis and Enhancement▲ 5 votes · Coding Comprehensive Framework for Auditing, Detecting, and Remediating Bugs and Vulnerabilities in Multi-Stack Repositories▲ 5 votes · Coding GitHub Repository Analyst▲ 2 votes · Coding

Alternatives

Other makers' add-ons that do the same job, next to this one.

Name	Score	Stars	Context	Updated
This onecode-security semgrep/skills · Skill	49	★ 330	≈153 always	3mo ago
resolve-docker-vulnerabilities firebase/firebase-tools · Skill Also for Docker	82	★ 4.5k	≈52 always	16d ago
security-sweep Onome-AJ/security-sweep-plugin · Plugin Also for Docker	44	★ 14	not measured	7mo ago
09-web-security Masriyan/Claude-Code-CyberSecurity-Skill · Skill Both about security and injection	66	★ 490	≈21 always	19d ago
owasp-security agamm/claude-code-owasp · Skill Both about security and cryptography	70	★ 386	≈118 always	1mo ago
verify-security Aurite-ai/agent-verifier · Skill Both about security and vulnerability	59	★ 45	≈58 always	22d ago

Install

mkdir -p .claude/skills/code-security

curl -sL https://codeload.github.com/semgrep/skills/tar.gz/68177b8830f96cd9d10dacbb14dde2566360503d | tar -xz -C .claude/skills/code-security --strip-components=3 "skills-68177b8830f96cd9d10dacbb14dde2566360503d/skills/code-security"

To remove it later:

rm -rf .claude/skills/code-security

npx skills add semgrep/skills --skill code-security

Pinned to commit 68177b8830f9 as listed by GitHub.

Context cost: ≈153 tokens loaded every session (name and description), plus ≈1.2k tokens when the skill is used.

The Claude Code command downloads this skill folder at the pinned commit into .claude/skills/. The Skills CLI (npx skills) works with many agents but can't pin a version, so it installs whatever is current.

Used for

Engineering › Debugging Engineering › Databases Engineering › DevOps & cloud Engineering › Git & GitHub Security › Security review

Tool pages

Docker GitHub

Facts

Repo: semgrep/skills
Stars: 330
Forks: 32
Last push: 2026-07-28 (3mo ago)
License: No license file (official maker)
Owner: semgrep · since 2017
Language: JavaScript
Works with: Claude Code, Skills CLI